cppa-cursor-browser: pin highlight.js (script + theme) with subresource integrity

[clean6378-max-it]

Sprint Item

#1 of 8 — Low severity — land first (Monday PR 1 of 3)

Block Relations

Blocked by	—
Blocks	#2 — CSP script-src must allow the SRI-pinned cdnjs origin
Repo/day	Independent of #4–#8 (claude-code-chat-browser / Tue–Thu)

Calendar Day

Monday, July 20, 2026 (PR 1 of 3)

Planned Effort

1 story point (Low) — sprint item #1

Problem

templates/base.html loads highlight.js from cdnjs with no integrity attribute:

• Theme <link> (vs2015) — line 19
• Script <script> — line 20

The neighboring Marked and DOMPurify tags already carry SRI hashes; highlight.js is the only unpinned third-party asset. A tampered or swapped CDN file would load and execute unverified — the gap in an otherwise SRI-pinned frontend.

Goal

One small PR that pins both highlight.js tags with the official cdnjs SRI hash for the already-in-use 11.9.0 files, matching the existing Marked/DOMPurify pattern. No version bump.

Scope

• Add integrity="sha512-..." + crossorigin="anonymous" to the highlight.js script tag (line 20), using the official cdnjs SRI value for the pinned 11.9.0 highlight.min.js.
• Add the same to the vs2015 theme <link> (line 19), using the cdnjs SRI value for the pinned 11.9.0 theme CSS.
• Do not change versions; do not touch the Marked/DOMPurify tags.

Out of scope

• The CSP header (Monday item Add optional exclusion rules for sensitive projects/chats #2, feat/csp-header) — the SRI-pinned cdnjs origin is what CSP script-src will allow.
• Any highlight.js version upgrade.

Acceptance Criteria

• Both highlight.js tags (script + theme) carry a correct integrity hash for the pinned 11.9.0 files.
• Both carry crossorigin="anonymous".
• Hashes are the official cdnjs SRI values (not hand-computed against a mirror).
• The page renders and code highlighting still works in the browser.
• CI green; PR approved by at least 1 reviewer.

Verification

cd C:\Users\Jasen\CppAliance\cppa-cursor-browser
.\.venv\Scripts\Activate.ps1
python app.py

• Open the app, view a conversation with a fenced code block → highlighting works.
• DevTools console shows no SRI integrity-mismatch errors.
• View source: highlight.js script + theme tags both carry integrity + crossorigin.